Visita Segura Privacy Policy

1. Identity of the Data Controller

DESARROLLO DE SOLUCIONES MOVILES, S. DE R.L. DE C.V. ("Visita Segura" or "SmartNova"), with registered address at Zaragoza 330, int 104, Colonia Centro, Queretaro, Queretaro, C.P. 76000, Mexico, is the data controller for the personal data collected through:

• The website visitasegura.com (the "Site")
• The mobile application Visita Segura for iOS and Android (the "Employee App")
• The mobile application Visita Segura Vigilante for iOS and Android (the "Guard App")
• The web administration panel (the "Web Panel")
• The MyLink digital invitation system

Collectively referred to as the "Service".

2. Applicable Regulations

This policy is aligned with:

• The Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.
• The General Data Protection Regulation (GDPR) of the European Union, applicable when the Service is used by individuals located in the EU or when processing data of European citizens.
• The INAI Guidelines on privacy notices (Mexico's National Institute for Transparency, Access to Information and Personal Data Protection).

3. Personal Data We Collect

Depending on how you interact with the Service, we may collect:

3.1 Data Collected on the Website (visitasegura.com)

3.2 Data Collected in the Mobile Applications

3.3 Data Collected in the Web Panel

4. Purposes of Processing

Primary purposes (necessary for the Service):

• Providing the contracted access control services
• User account authentication and management
• Generating and sending digital invitations with QR codes
• Registering entries and exits with photo evidence
• Managing tool, material, and package vouchers
• Generating analytical reports and dashboards
• REPSE document management for suppliers (when applicable)
• Notifications about visitor arrivals and events
• Multi-site management and centralized control

Secondary purposes (optional):

• Sending promotional information or Service updates
• Product improvement through aggregated usage analysis
• Commercial contact following a demo request on the Site

If you do not wish your data to be used for secondary purposes, you may notify us at privacidad@visitasegura.com.

5. Legal Basis for Processing (GDPR)

• Contract performance (Art. 6.1.b GDPR): To provide the contracted services.
• Consent (Art. 6.1.a GDPR): For sending commercial communications and the Site's contact form.
• Legitimate interest (Art. 6.1.f GDPR): For security, fraud prevention, and Service improvement.
• Legal obligation (Art. 6.1.c GDPR): For compliance with regulations such as REPSE.

6. Transfers and Data Processors

Your data may be shared with the following third parties, exclusively for the provision of the Service:

For international transfers, equivalent levels of protection are guaranteed in accordance with the GDPR (standard contractual clauses) and the LFPDPPP.

We do not sell, rent, or share your personal data with third parties for marketing purposes without your express consent.

7. Data Subject Rights (ARCO + GDPR)

You have the right to:

To exercise any of these rights, send your request to:

• Email: privacidad@visitasegura.com
• Response time: 20 business days (LFPDPPP) / 30 days (GDPR)

Your request must include: full name, email address associated with your account, description of the right you wish to exercise, and, where applicable, a copy of official identification.

8. Data Retention

• Visitor data (photos, access records): 90 days from the date of registration, unless otherwise required by law or configured by the client company.
• User account data: While the account is active. 30 days after cancellation for billing data.
• Contact form data from the Site: 12 months or until the commercial relationship is established or discarded.
• REPSE documentation: In accordance with the periods established by applicable regulations.
• Analytics data (Google Analytics): In accordance with Google's retention policy (26 months by default).

After the applicable retention periods, data will be deleted or irreversibly anonymized.

9. Cookies and Tracking Technologies

The Site uses the following technologies:

You can configure your browser to block cookies. However, some functionalities of the Site may be affected.

10. Information Security

We implement reasonable administrative, physical, and technical security measures to protect your data, including:

• SSL/TLS encryption on all transmissions
• Dynamic QR codes with time-based expiration
• Storage on servers with security certifications (AWS)
• Role-based access control within the platform
• Input data sanitization to prevent injections
• Anti-bot protection on forms (honeypot, rate limiting)

However, no internet transmission is 100% secure. We do not recommend using unprotected public Wi-Fi networks to access the Service.

11. Minors

The Service is not intended for individuals under 18 years of age. We do not knowingly collect data from minors. If we discover that we have collected data from a minor, we will delete it immediately.

12. Changes to the Privacy Policy

We reserve the right to update this Privacy Policy at any time. Changes will be posted on this page with the corresponding update date. Continued use of the Service after changes are posted constitutes acceptance of those changes.

For substantial changes, we will notify registered users by email or through the application.

13. Data Protection Authorities

If you believe your rights have not been respected, you may file a complaint with:

• Mexico: National Institute for Transparency, Access to Information and Personal Data Protection (INAI) — www.inai.org.mx
• European Union: The data protection authority in your member state.

14. Contact

Data Controller: DESARROLLO DE SOLUCIONES MOVILES, S. DE R.L. DE C.V.
Trade name: Visita Segura (SmartNova)
Email: privacidad@visitasegura.com
Phone: +52 442 181 5955
Address: Zaragoza 330, int 104, Colonia Centro, Queretaro, Qro., C.P. 76000, Mexico.